toga-ai 1.0.794 → 1.0.796

package/knowledge/2.0/apps/_underscore/features/calculated-sql-fields.md

@@ -20,6 +20,8 @@ files:
   - api2/Component/Api/V2/V2.php
   - _underscore/Model/Quad/Item.php
   - _underscore/Model/Quad/VendorItem.php
+  - _underscore/Model/Nychh/Unit.php
+  - dbchanges2/Client_Nychh/2026-09-10a - UnitsForPoTableViewRebaseAndTransferLocationField.sql
   - dbchanges2/Client/2026-08-11b - SalesOrderPurchaseOrdersField.sql
   - dbchanges2/Client/2026-08-25 - SalesOrderPurchaseOrdersFieldAllClients.sql
 related:
@@ -253,6 +255,23 @@ characters — that is the standard of evidence for touching a field that runs o
   [save-cascade stored-field deadlocks](./model-save-parent-cascade-stored-field-deadlock.md).
 
 ## Change history
+- 2026-09-10 — Added two NYCHH-only calc fields on `_Model_Nychh_Unit`
+  (`_underscore/Model/Nychh/Unit.php`) for the rebuilt `units-for-items-for-purchase-orders` grid,
+  both plain `FIELD_SQL` (text — no `FIELDOPT_SQL_TYPE`): **(a)** an **override** of
+  `_unitDisposition()` — NYCHH does **not** use the `UnitDispositions` lookup; disposition is derived
+  purely from the transfer chain (`Deployed` if an `ItemFulfillmentItems` with
+  `transferOrderItemId IS NOT NULL` exists for the unit, else `Available`). The override **matches the
+  parent's untyped signature exactly** (the contravariance fatal above). **(b)** a **new**
+  `_transferLocation` field returning the transfer-order destination location name via
+  Units → ItemFulfillmentItemUnits → ItemFulfillmentItems → TransferOrderItems → TransferOrders →
+  destinationLocationId → Locations (`ORDER BY` fulfillment id `DESC LIMIT 1`), registered as a
+  `Client_Nychh.CustomRecordFields` row (record 31) + Base-role `AclCustomFieldPermissions` grant in
+  `Client_Nychh/2026-09-10a`. **Why a calc field and not a TableView join:** the location chain
+  re-uses `ItemFulfillmentItems`/`ItemFulfillmentItemUnits` a **second** time, and `TableViewJoins`'
+  `onB` renders the raw table name — so a chain off a duplicated table binds to the wrong copy (the
+  duplicate-join hazard in [tableview-joins](./tableview-joins.md)). A calc field sidesteps the alias
+  problem entirely. Column header labeled via a `ClientCustomRecordFieldSettings` `label-singular`
+  row ("Location"). (jcardinal)
 - 2026-09-10 — **Fixed `_Model_Client_Location::_addressState()` to return the state CODE, not
   `Addresses.stateId`** (addresses rendered as `Bronx, 33 10451-5504`). Added
   `LEFT JOIN States ON States.id = Addresses.stateId` inside the subquery and selected `States.code`

package/knowledge/2.0/apps/_underscore/features/page-meta-context-field-settings.md

@@ -6,8 +6,8 @@ project: _Underscore
 client: shared
 type: feature
 status: active
-updated: 2026-08-26
-owners: [tcox, bala]
+updated: 2026-09-10
+owners: [tcox, bala, jcardinal]
 files:
   - _underscore/Model/Core/Page.php
   - _underscore/Model/Client/TableView.php
@@ -64,6 +64,19 @@ record route resolved through `$lookupRecordIdFromCustomRecordFieldId` →
 metadata**, and no amount of adding/correcting those rows will move the header. (Measured
 2026-08-26: two hours lost adding label rows that could never be read.)
 
+> **⚠ SCOPE — this "dead metadata" is the legacy `Page.php` / `toga2-supply` path ONLY. On the
+> `toga25-supply` table path it WORKS.** `toga25-supply` reads its grid headers from
+> `/table-views/meta` (`_Model_Client_TableView::meta()`), which fetches
+> `ClientCustomRecordFieldSettings` directly — so a **base** custom-field column (both context
+> columns NULL) IS labeled by a `ClientCustomRecordFieldSettings` row with `settingId = 5`
+> (`Core.Settings.slug = 'label-singular'`), `isOverridable = 1`. Verified live 2026-09-10: this is
+> exactly how `Client_Elite` labels its custom unit columns (`c_grade` → "Grade", `c_chargingBrick`
+> → "Charging Brick", …), and it is how NYCHH's `_transferLocation` column on
+> `units-for-items-for-purchase-orders` gets its "Location" header
+> (`Client_Nychh/2026-09-10c - TransferLocationColumnLabel.sql`). Do **not** move a custom field to
+> a Core `RecordField` just to get a header on a `toga25-supply` grid — the client custom-field
+> settings row is enough. The dead-metadata trap above still holds for the old `Page.php` consumers.
+
 Where the label must come from instead, for such a column:
 
 - **`Core.DefaultRecordFieldSettings`** on the underlying **Core** `RecordField`, or
@@ -181,6 +194,14 @@ data change, is what makes it fatal.
   customization. The guard belongs in the framework.
 
 ## Change history
+- 2026-09-10 — Scoped the "custom record field's label row is dead metadata" finding to the **legacy
+  `Page.php` / `toga2-supply`** consumer only. On the **`toga25-supply`** grid (headers from
+  `/table-views/meta` via `_Model_Client_TableView::meta()`, which fetches
+  `ClientCustomRecordFieldSettings` directly) a **base** custom-field column IS labeled by a
+  `ClientCustomRecordFieldSettings` row (both context columns NULL, `settingId = 5` =
+  `label-singular`, `isOverridable = 1`) — so the field need NOT be promoted to a Core `RecordField`
+  for a header. Verified against `Client_Elite`'s custom unit columns and NYCHH's `_transferLocation`
+  ("Location") on the units-for-items-for-purchase-orders view. (jcardinal)
 - 2026-08-26 - Documented that a grid column's **type** and its **header label** come from two
   different endpoints: type/formatting (the currency icon) from `/table-views/meta`
   `table.fields[].type` via `generateDynamicConfig` → `formatTableData`, header text from

package/knowledge/2.0/apps/_underscore/features/tableview-joins.md

@@ -6,7 +6,7 @@ project: _Underscore
 client: shared
 type: feature
 status: active
-updated: 2026-09-03
+updated: 2026-09-10
 owners: [bala, apeterson, jcardinal]
 files:
   - _underscore/Model/Client/TableView.php
@@ -19,6 +19,8 @@ files:
   - dbchanges2/Client_Nychh/2026-08-28a - TransferOrdersTableView.sql
   - dbchanges2/Client_Nychh/2026-08-31a - PurchaseOrdersTableViewRebase.sql
   - dbchanges2/Client_Nychh/2026-09-02a - PurchaseOrderItemsTableViewRebase.sql
+  - dbchanges2/Client_Nychh/2026-09-10a - UnitsForPoTableViewRebaseAndTransferLocationField.sql
+  - dbchanges2/Client_Nychh/2026-09-10b - UnitsForPoBridgeBaseAclGrant.sql
 related:
   - ../../api2/features/tableview-field-metadata.md
   - ./page-meta-context-field-settings.md
@@ -232,6 +234,29 @@ So a role gap only 500s when a **visible column** hangs off the missing join —
 client tolerates ACL gaps on records another client cannot. A new joined table (here
 `Manufacturers`, record 20) needs its `AclRecordPermissions` grant in the same migration.
 
+#### A dropped BRIDGE join in the middle of a chain 1054s even with NO column on it
+
+The "harmless until a column hangs off it" rule has a sharp exception: a **bridge** join that sits
+**in the middle of a chain**. Nothing shows a column from the bridge, but a **later** join's `onB`
+names the bridge's raw table. When ACL drops the bridge, that later join emits an ON clause
+referencing a table that was never added → **MySQL 1054**, not the readable
+`AclRecordPermissions`-message from mode (b).
+
+Confirmed NYCHH 2026-09-10 on the rebuilt `units-for-items-for-purchase-orders` view. The bridge
+record **`PurchaseOrderItems_SalesOrderItems`** (Core record **290**) carried only an **API-role**
+read grant in `Client_Nychh`. Records 30/29/15/18 in the chain already had a **Base** grant, so a
+Base user's joins query dropped only the bridge — and the next join's ON referenced it:
+
+```
+Unknown column 'PurchaseOrderItems_SalesOrderItems.purchaseOrderItemId' in 'on clause'
+```
+
+Fix: add the **Base** read grant as the full 4-table ACL chain (`AclRecordPermissions` →
+`AclLogicGroups` → `AclLogicGroupExpressions`), reusing record 290's existing `all`
+`AclRecordExpression` (`Client_Nychh/2026-09-10b - UnitsForPoBridgeBaseAclGrant.sql`). Watch for
+**bridge records that ship with API-only grants** — a view that only ever ran for an API caller
+(or in an environment tested as API) hides this until a Base user opens it.
+
 ### The debugging signature: 500 + EMPTY body + NO row in `Logs_<client>.Api`
 
 Mode (a) throws *before* the response is assembled, so the caller gets a **500 with an empty
@@ -347,6 +372,14 @@ Core-level reference ids used (identical across all clients and environments): *
 
 ## Change history
 
+- 2026-09-10 — Added the **bridge-in-a-chain ACL-drop = 1054** exception to mode (b): a dropped
+  bridge join with **no column on it** still breaks, because the next join's `onB` names the bridge's
+  raw table. NYCHH's rebuilt `units-for-items-for-purchase-orders` view 1054'd for a **Base** user —
+  bridge record 290 (`PurchaseOrderItems_SalesOrderItems`) had only an **API-role** grant while the
+  rest of the chain (30/29/15/18) had Base; error *"Unknown column
+  'PurchaseOrderItems_SalesOrderItems.purchaseOrderItemId' in 'on clause'"*. Fixed with the full
+  4-table Base ACL chain reusing record 290's `all` expression (`Client_Nychh/2026-09-10b`). Watch
+  for bridge records that ship with API-only grants. (jcardinal)
 - 2026-09-03 — Added the **filter-only join counterpart** to the PO-items rebase: dropping a
   column-less join that only *filtered* rows (SalesOrders→bridge→PurchaseOrders, ids 123/124/141)
   breaks any row-filter still targeting that table. NYCHH's `items-for-purchase-orders`

package/knowledge/2.0/apps/_underscore/features/units-for-items-for-purchase-orders.md

@@ -6,12 +6,18 @@ project: _Underscore
 client: shared
 type: feature
 status: active
-updated: 2026-08-28
-owners: ["bala", "tcox"]
+updated: 2026-09-10
+owners: ["bala", "tcox", "jcardinal"]
 files:
   - _underscore/Model/Client/ServiceRequest.php
+  - _underscore/Model/Nychh/Unit.php
   - dbchanges2/Client/2026-08-11a - ServiceRequestsInventoryUnitsTableViews.sql
+  - dbchanges2/Client_Nychh/2026-09-10a - UnitsForPoTableViewRebaseAndTransferLocationField.sql
+  - dbchanges2/Client_Nychh/2026-09-10b - UnitsForPoBridgeBaseAclGrant.sql
+  - dbchanges2/Core/2026-09-10a - InventoryGroupingsUnitsLeafPoItemFilter.sql
 related:
+  - ./calculated-sql-fields.md
+  - ./tableview-joins.md
   - ./tracking-number-bridges.md
   - ../../../clients/elite/features/supply2-tableview-config-drift.md
   - ../../../clients/prudential/features/supply-orders-csv-export.md
@@ -74,6 +80,41 @@ a *different field per client*, so client custom columns (and their
 Elite's four columns at index 14-17 (`grade`, `chargingBrick`, `chargingCable`, `wipeStatus` via
 `c_deviceStatus`).
 
+## NYCHH rebuilt the view onto the FULFILLMENT chain (2026-09-10)
+
+This is the "resolver/view change that also walks the fulfillment path" the first gotcha below asks
+for — shipped for one tenant. `Client_Nychh`'s `units-for-items-for-purchase-orders` view (base
+record **Units 31**) was rebuilt to list the serialized units for a clicked **purchase-order item**,
+showing Serial #, Asset Tag, Disposition, Location. The old 25-join / 12-column config (inaccurate)
+was replaced with an **INNER** chain:
+
+```
+Units
+  -> ItemFulfillmentItemUnits (30)
+  -> ItemFulfillmentItems (29)
+  -> PurchaseOrderItems_SalesOrderItems bridge (290)
+  -> PurchaseOrderItems (18)
+```
+
+plus a **filter-only** `SalesOrderItems (15)` join kept so the `itemsByPOs` drill path (which filters
+by `SalesOrderItems.uuid`) still works. The grid is filtered at drill-down time by
+`(PurchaseOrderItems.uuid:eq:...)`. File:
+`dbchanges2/Client_Nychh/2026-09-10a - UnitsForPoTableViewRebaseAndTransferLocationField.sql`.
+
+Two column values come from **NYCHH-only calc fields** on `_Model_Nychh_Unit`, not joins —
+Disposition (`_unitDisposition`, overridden to derive from the transfer chain) and Location
+(`_transferLocation`, new). Location is a calc field precisely because its chain re-uses
+`ItemFulfillmentItems`/`ItemFulfillmentItemUnits` a **second** time, which the TableView alias model
+cannot express (see [calculated-sql-fields](./calculated-sql-fields.md) and the duplicate-join hazard
+in [tableview-joins](./tableview-joins.md)).
+
+Two failures surfaced during this rebuild, both documented on
+[tableview-joins](./tableview-joins.md): the mid-chain bridge record 290 shipped with an **API-only**
+ACL grant, so a Base user 1054'd on `PurchaseOrderItems_SalesOrderItems.purchaseOrderItemId` in the
+next join's ON clause (fixed by `Client_Nychh/2026-09-10b`); and the Inventory `posByItems` **leaf**
+`additionalDataSlug` had to be the bare table name `PurchaseOrderItems` (the FE appends `.uuid`, so a
+stored `PurchaseOrderItems.uuid` doubled to `.uuid.uuid` and 500'd — `Core/2026-09-10a`).
+
 ## Serial numbers for a Service Request - the bridge table is empty, use the fulfillment chain
 
 `_Model_Client_ServiceRequest::_serialNumbers` (a `FIELD_SQL` field, so every client inherits it)
@@ -143,7 +184,10 @@ None — uniform. The linkage structure is framework-level and identical across
 - **Missing item bridge → no units**, even when units were received. Without a
   `SalesOrderItems_PurchaseOrderItems` row, the receipt path has no starting link.
 - **A present bridge is not sufficient.** If the bridged PO line has no
-  `ItemReceiptItemUnits`, the receipt path still resolves to nothing.
+  `ItemReceiptItemUnits`, the receipt path still resolves to nothing. The **fulfillment-chain**
+  analog (NYCHH rebuild): a PO line with a bridge **and** a fulfillment but **zero
+  `ItemFulfillmentItemUnits`** (no serialized units captured) correctly shows an **empty grid** — that
+  is not a bug, just a line with no serials recorded.
 - **`inventoryType` determines unit existence**: `SERIALIZED` and `HYBRID` items can produce
   unit records; `NON_SERIALIZED` (bulk/consumable) never do. `HYBRID` items fulfilled as a
   plain quantity (no serial capture) also produce no units — legitimately blank.
@@ -172,6 +216,15 @@ None — uniform. The linkage structure is framework-level and identical across
   rather than reading the SQL.
 
 ## Change history
+- 2026-09-10 - `Client_Nychh` **rebuilt this view onto the fulfillment chain** (Units → 30 → 29 →
+  290 bridge → PurchaseOrderItems 18, filtered by `(PurchaseOrderItems.uuid:eq:...)`), the first
+  "resolver that walks the fulfillment path" — lists serialized units for a clicked PO item with
+  Serial #, Asset Tag, Disposition, Location. Disposition/Location come from NYCHH-only
+  `_Model_Nychh_Unit` calc fields (`_unitDisposition` override, new `_transferLocation`) because the
+  location chain re-uses `ItemFulfillmentItems` twice. Added the empty-grid gotcha (bridge +
+  fulfillment but zero `ItemFulfillmentItemUnits` = correctly blank). Cross-refs the bridge Base-ACL
+  1054 and the surface-leaf slug-doubling fixes on [tableview-joins](./tableview-joins.md). Files:
+  `Client_Nychh/2026-09-10a`, `Client_Nychh/2026-09-10b`, `Core/2026-09-10a`. (jcardinal)
 - 2026-08-28 - Corrected the `ServiceRequests_Units` "0 rows" note: that is an **Elite** measurement,
   not a schema fact - `Client_Prudential` has **30,268 rows** and the bridge is the only unit-to-order
   route there for never-shipped units (`SalesOrderItems_CommittedUnits` is the empty one on Prudential,

package/knowledge/2.0/apps/api2/features/request-logging.md

@@ -6,7 +6,7 @@ project: API
 client: shared
 type: feature
 status: active
-updated: 2026-09-01
+updated: 2026-09-10
 owners: ["mhammontree", "dfranks", "bala", "jcardinal"]
 files:
   - api2/Component/Api/V2/V2.php
@@ -21,6 +21,7 @@ related:
   - ./environment-variable-drives-underscore-branch.md
   - ../../_underscore/features/error-reporting-issue-event.md
   - ../../../../clients/aig/features/entitlement-intake.md
+  - ../../../../clients/prudential/features/service-request-auth-rejection-alert.md
   - ../../../../clients/compass-usa/features/mits-po-to-so-item-linking.md
   - ../../../../clients/compass-usa/workflows/order-lifecycle-and-data-integrity.md
 ---
@@ -53,6 +54,24 @@ In `api2/Component/Api/V2/V2.php` (~L2168) every request is logged and routed:
 - There is also a **config-gated branch** (~L2166): when `_Config::api('log_filepath')` is set,
   the log entry is written to a **file** on the host instead of the DB.
 
+### 401 lands in base `Logs`; 403 lands in `Logs_<Client>`
+
+The pre-scope/post-scope split above has a sharp, practical edge on the two auth codes:
+
+- **401** (`EN-1`..`EN-6`, e.g. an expired token) is decided in the auth chain in `V2.php`
+  (~L2088, inside `execute()`) **before routing**, so the client is not resolved and the row can
+  only go to the **shared base `Logs`**.
+- **403** happens **after** the client IS known, so that row lands in **`Logs_<Client>`**.
+
+Verified on Prudential for 2026-08-31 – 09-01: `Logs_Prudential.Api` held **56** rows for
+`/v2/service-requests`, **all 201**, while every one of the **36 401s** sat in base `Logs`.
+
+**A 401 therefore can never reach a model interceptor** — no `prePost`/`postPost` hook can alert on
+it, because routing and the model are never reached. Anything that must react to refused inbound
+traffic has to **scan the base log**, not hook the model. The caller is still identifiable: decode
+the Bearer token in `requestHeaders` and read `id.client.uuid`. See
+[Prudential refused-REQ alert](../../../../clients/prudential/features/service-request-auth-rejection-alert.md).
+
 ### A rejected request (HTTP 400) is NOT unlogged
 
 `api2/Controller/Index.php` (L369-377) handles a non-success response by **committing** the
@@ -359,6 +378,13 @@ The working pattern, in order:
 > a field its response echo omitted (see the [V2 query contract](v2-rest-query-contract.md) PUT-echo
 > gotcha).
 
+> **What is actually indexed (checked with `SHOW INDEX`, 2026-09-10):** `dtStamp` **IS** indexed
+> — `Api_dtStamp_IDX` — in **both** the base `Logs` (~3.67M rows) and `Logs_Prudential` (~7.86M
+> rows). `route` and `responseCode` are **NOT** indexed. So a *tight* `dtStamp` window is cheap
+> (a 15-minute slice is trivial), but a **wide** `dtStamp` range combined with a `route` filter
+> still times out — a 2.5-month grouped query aborted at 300 s. Narrow the time window first;
+> the other predicates do no work for you.
+
 1. **Narrow with indexed / non-text columns only** — a `dtStamp` range plus `route`,
    `method`, `responseCode`, `hostname`. A
    `GROUP BY hostname, route, method, responseCode` over one day is cheap and is the fastest way
@@ -400,6 +426,16 @@ re-send.
 > replay operationally, not by pasting payloads into the KB.
 
 ## Change history
+- 2026-09-10 — Sharpened the client-vs-core routing on the auth codes: a **401 always lands in the
+  base `Logs`** (decided in the auth chain ~L2088 before routing, client unresolved) while a **403
+  lands in `Logs_<Client>`** (client already known) — verified on Prudential 31 Aug–1 Sep, where
+  `Logs_Prudential.Api` held 56 rows for `/v2/service-requests` (all 201) and all **36 401s** were
+  in base `Logs`. Consequence: **no model interceptor can ever fire for a 401**, so alerting on
+  refused inbound traffic must scan the base log; the caller is recoverable by decoding
+  `id.client.uuid` from the Bearer token. Also corrected the index picture with `SHOW INDEX`:
+  `Logs.Api.dtStamp` **is** indexed (`Api_dtStamp_IDX`) in both base `Logs` (~3.67M rows) and
+  `Logs_Prudential` (~7.86M rows), but `route`/`responseCode` are **not** — a tight window is cheap,
+  a wide window plus a route filter still aborts at 300 s. No code change. (bala)
 - 2026-09-01 — **Fixed the duplicate-`transactionId` 500** (`Logs.Issue CT`, `TRUE-81056` /
   `db94a26`): the log-save at the end of `execute()` did a **check-then-insert**, which cannot work
   under concurrency because the rival copy's row is still uncommitted and therefore invisible to the

package/knowledge/2.0/apps/api2/features/v2-api-error-codes.md

@@ -6,7 +6,7 @@ project: API
 client: shared
 type: feature
 status: active
-updated: 2026-08-25
+updated: 2026-09-10
 owners: [mhammontree, tcox, jcardinal, ajean, bala, apeterson]
 files:
   - api2/Component/Api/V2/V2.php
@@ -140,6 +140,13 @@ migration instead of re-deriving it. All field/script ACL rows live in the **CLI
    `error.id` like `"8K-6"`. The part **before the dash** is `Logs.Issue.reference` —
    `SELECT * FROM Logs.Issue WHERE reference = '8K'` gives the full `errorMessage` and stack
    trace. The envelope itself tells you nothing useful; always go to `Logs.Issue`.
+   **A developer will often hand you this id verbally (e.g. "V7-6") to investigate — split on the
+   hyphen: the first part (`V7`) is `Logs.Issue.reference`, the second (`6`) is
+   `Logs.Event.eventNumber`. The two tables join on `Logs.Event.issueId = Logs.Issue.id`, so the
+   exact occurrence (and its `Logs.Event.clientId` tenant) is
+   `SELECT * FROM Logs.Event JOIN Logs.Issue ON Logs.Event.issueId = Logs.Issue.id WHERE
+   Logs.Issue.reference = 'V7' AND Logs.Event.eventNumber = 6`.** (`Logs.Issue` has no `dtUpdated`
+   column.)
    Corollary: if `transactionId`, `authority` and `audience` are **all NULL** in the error
    envelope, the request failed **before client context was established**.
 
@@ -292,6 +299,10 @@ Full mechanics:
 - The response-envelope shape and code families: see [api2 architecture](../architecture.md).
 
 ## Change history
+- 2026-09-10 — Made the developer-shorthand decode of an `error.id` explicit under diagnosis note 9:
+  a verbally-provided id like "V7-6" splits into `Logs.Issue.reference` (before the hyphen) +
+  `Logs.Event.eventNumber` (after), joined by `Logs.Event.issueId = Logs.Issue.id`; added the ready
+  `Logs.Event JOIN Logs.Issue` lookup and noted `Logs.Issue` has no `dtUpdated` column. (jcardinal)
 - 2026-08-27 — Added three codes/notes from the NYCHH transfer-order POST work: **EV-10** (a NOT NULL
   column received NULL — `originLocationId cannot be null`; resolve upstream or default in the ORM), a
   second **EV-12** flavor (`searchableIdentifierFields:[id]` — a nested FK resolved *through* a `c_`

package/knowledge/INDEX.md

@@ -5,7 +5,7 @@ _Auto-generated by `knowledge.js index`. Do not hand-edit._
 ## 1.0 framework
 
 - **library** (Library) _(framework core)_ — 25 doc(s) → [1.0/apps/library/INDEX.md](1.0/apps/library/INDEX.md)
-- **worker** (Worker) — 34 doc(s) → [1.0/apps/worker/INDEX.md](1.0/apps/worker/INDEX.md)
+- **worker** (Worker) — 35 doc(s) → [1.0/apps/worker/INDEX.md](1.0/apps/worker/INDEX.md)
 - **dbchanges** (Database Changes) _(framework core)_ — 1 doc(s) → [1.0/apps/dbchanges/INDEX.md](1.0/apps/dbchanges/INDEX.md)
 - **worker1.5** (Worker 1.5) — 0 doc(s) → [1.0/apps/worker1.5/INDEX.md](1.0/apps/worker1.5/INDEX.md)
 - **togadesk** (TOGa Desk) — 13 doc(s) → [1.0/apps/togadesk/INDEX.md](1.0/apps/togadesk/INDEX.md)

package/knowledge/clients/nychh/profile.md

@@ -33,6 +33,12 @@ files:
   - dbchanges2/Client/2026-09-01a - PurchaseOrderItemQtyFieldsApiRoleRead.sql
   - dbchanges2/Client_Nychh/2026-09-02a - TalosAssistantEnable.sql
   - dbchanges2/Client_Nychh/2026-09-09c - UpdateLocationShippingAddresses.sql
+  - _underscore/Model/Nychh/Unit.php
+  - dbchanges2/Client_Nychh/2026-09-10a - UnitsForPoTableViewRebaseAndTransferLocationField.sql
+  - dbchanges2/Client_Nychh/2026-09-10b - UnitsForPoBridgeBaseAclGrant.sql
+  - dbchanges2/Client_Nychh/2026-09-10c - TransferLocationColumnLabel.sql
+  - dbchanges2/Core/2026-09-10a - InventoryGroupingsUnitsLeafPoItemFilter.sql
+  - dbchanges2/Core/2026-09-10b - UnitDispositionColumnLabel.sql
 related:
   - ./features/location-shipping-addresses.md
   - ../../2.0/apps/dbchanges2/workflows/deleting-contacts-from-a-client-database.md
@@ -206,6 +212,51 @@ table views. Client-specific DB change-sets live in `dbchanges2/Client_Nychh/`.
      `PurchaseOrders.id` 81, onB `PurchaseOrderItems.purchaseOrderId` 90, sortOrder 7, no column). No
      new ACL — record 17 already has Base/Developer/API read. Mechanism:
      [tableview-joins](../../2.0/apps/_underscore/features/tableview-joins.md).
+- **`units-for-items-for-purchase-orders` view rebuilt to list serials for a clicked PO item
+  (2026-09-10).** Base record Units (31). The old 25-join / 12-column config (inaccurate) was replaced
+  with an INNER chain **Units → ItemFulfillmentItemUnits (30) → ItemFulfillmentItems (29) →
+  PurchaseOrderItems_SalesOrderItems bridge (290) → PurchaseOrderItems (18)**, plus a **filter-only**
+  `SalesOrderItems (15)` join kept so the `itemsByPOs` drill (filters by `SalesOrderItems.uuid`) still
+  works. Filtered at drill-down by `(PurchaseOrderItems.uuid:eq:...)`. Columns: Serial #, Asset Tag,
+  Disposition, Location. File `Client_Nychh/2026-09-10a -
+  UnitsForPoTableViewRebaseAndTransferLocationField.sql`. Four connected pieces:
+  1. **Two NYCHH-only calc fields on `_Model_Nychh_Unit`** (`_underscore/Model/Nychh/Unit.php`), both
+     plain `FIELD_SQL` text. **`_unitDisposition` is OVERRIDDEN** — NYCHH does **not** use the
+     `UnitDispositions` lookup; disposition is `Deployed` if an `ItemFulfillmentItems` with
+     `transferOrderItemId IS NOT NULL` exists for the unit, else `Available` (override matches the
+     parent's untyped signature exactly). **`_transferLocation` is NEW** — the transfer-order
+     destination location name via Units → ItemFulfillmentItemUnits → ItemFulfillmentItems →
+     TransferOrderItems → TransferOrders → destinationLocationId → Locations (`ORDER BY` fulfillment
+     id `DESC LIMIT 1`); registered as a `Client_Nychh.CustomRecordFields` row (record 31) + Base
+     `AclCustomFieldPermissions`. It is a calc field, **not** a join, because the chain re-uses
+     `ItemFulfillmentItems`/`ItemFulfillmentItemUnits` a second time and the TableView alias model
+     would bind to the wrong copy. See
+     [calculated-sql-fields](../../2.0/apps/_underscore/features/calculated-sql-fields.md).
+  2. **Bridge Base ACL grant** — record 290 (`PurchaseOrderItems_SalesOrderItems`) shipped with only
+     an **API-role** read grant, so a Base user's joins query dropped the bridge and the next join's
+     ON errored `Unknown column 'PurchaseOrderItems_SalesOrderItems.purchaseOrderItemId' in 'on
+     clause'` (MySQL 1054). Fixed with the full 4-table Base ACL chain reusing record 290's `all`
+     expression: `Client_Nychh/2026-09-10b - UnitsForPoBridgeBaseAclGrant.sql`. Records 30/29/15/18
+     already had Base. Mechanism: [tableview-joins](../../2.0/apps/_underscore/features/tableview-joins.md).
+  3. **Surface drill-down LEAF slug** — the `inventory-list-groupings` `posByItems` **leaf**
+     `additionalDataSlug` had to be the bare table name `PurchaseOrderItems` (NOT
+     `PurchaseOrderItems.uuid`); the FE appends `.uuid` itself, so a stored `.uuid` doubled to
+     `.uuid.uuid` and 500'd (1054). Same doubling rule as the swap level above, one level deeper. This
+     is `Core.SurfaceElements` (all-client, no NYCHH override); `Core/2026-09-10a -
+     InventoryGroupingsUnitsLeafPoItemFilter.sql` (guard covers both `SalesOrderItems.uuid` and the
+     interim `PurchaseOrderItems.uuid`). Confirmed in toga25-supply
+     `useInventoryPageViewModel.tsx` (getAdditionalData).
+  4. **Column labels (settings layer, `Core.Settings` id 5 = `label-singular`)** — Disposition via a
+     `Core.DefaultRecordFieldSettings` row on Core field 619 (`_unitDisposition`), value "Disposition"
+     (`Core/2026-09-10b - UnitDispositionColumnLabel.sql`); Location via a
+     `Client_Nychh.ClientCustomRecordFieldSettings` row on `_transferLocation` (context columns NULL,
+     settingId 5, `isOverridable 1`), value "Location" (`Client_Nychh/2026-09-10c -
+     TransferLocationColumnLabel.sql`). Without a label row the grid falls back to the raw
+     `TableViewFields.slug`.
+  - **Empty grid for a given PO item is correct** when that line has a bridge + fulfillment but zero
+    `ItemFulfillmentItemUnits` (no serialized units captured) — not a bug.
+  - **Deploy:** the `_underscore` model change must land on **`_production`** and **`_sandbox-client`**
+    (api2 pulls `_underscore` per environment by branch); the SQL files run on prod + client-sandbox.
 - **`inventory_units` table view carries item detail as of 2026-08-18** — Part Number, Manufacturer
   and Item Description sit directly after Asset Tag, reached through a **chained** Units → Items →
   Manufacturers join (`dbchanges2/Client_Nychh/2026-08-18 - InventoryUnitsItemColumns.sql`, identical

package/knowledge/clients/prudential/INDEX.md

@@ -8,6 +8,7 @@
 | [Prudential: OneUptime order-pipeline backlog monitors (Monitor/Prudential/*)](features/oneuptime-order-pipeline-monitors.md) | 2.0 | Three worker2 OneUptime push monitors (TRUE-80587) that watch the Prudential/Dell order pipeline for **stalls**, which were previously invisible — a stuck pipel |
 | [Prudential: order email PDF attachments (which guide goes on which email)](features/order-email-pdf-attachments.md) | 1.0 | Every customer-facing Prudential order email carries S3-hosted PDF guides, and **which** guide is attached is decided by the service request type. |
 | [Prudential: Service Request Regional Address Validation](features/service-request-address-validation.md) | 2.0 | The `prePost` interceptor on `_Model_Prudential_ServiceRequest` validates `deliverToAddress` fields differently depending on which Prudential regional customer |
+| [Prudential: refused REQ alert (401/403 on POST /v2/service-requests)](features/service-request-auth-rejection-alert.md) | 1.0 | ServiceNow posts every Prudential REQ to `POST /v2/service-requests`. |
 | [Prudential: Service Request rejection alert email](features/service-request-rejection-alert-email.md) | 2.0 | When a Prudential ServiceNow→TOGa service-request submission (`POST /v2/service-requests`) is **rejected by validation**, TOGa now sends a real-time internal al |
 | [Prudential: Sales Orders CSV export (TOGa 2.5 Supply)](features/supply-orders-csv-export.md) | 2.0 | The **Export** button on the TOGa 2.5 Supply *Sales Orders* page is **Prudential-only**: it downloads a 22-column CSV (`prudential-orders-<YYYY-MM-DD>.csv`) cov |
 | [Prudential Order Shipped Email — transmit_ordershipped_updates_prudential.php](features/transmit-ordershipped-email.md) | 1.0 | Cron script that transmits "Order Shipped" updates to ServiceNow (RITM) and sends a shipped notification email to the end user. |

package/knowledge/clients/prudential/features/service-request-auth-rejection-alert.md

@@ -0,0 +1,156 @@
+---
+title: "Prudential: refused REQ alert (401/403 on POST /v2/service-requests)"
+framework: "1.0"
+repo: worker
+project: Worker
+client: prudential
+type: client-feature
+status: active
+updated: 2026-09-10
+owners: ["bala"]
+files:
+  - worker/crons/notifications/reports/prudential/prudential_auth_rejection_alert.php
+  - worker/schedules/cron.worker.notification.json
+  - worker/crons/notifications/reports/prudential_exception_report.php
+  - worker/crons/notifications/reports/prudential/prudential_api_500_retry.php
+related:
+  - service-request-rejection-alert-email.md
+  - service-request-address-validation.md
+  - ../profile.md
+  - ../../../2.0/apps/api2/features/request-logging.md
+  - ../../../2.0/apps/api2/features/v2-api-error-codes.md
+---
+
+## Summary
+
+ServiceNow posts every Prudential REQ to `POST /v2/service-requests`. When we **refuse** that
+request at the door — **401** (login token bad or expired) or **403** (permissions) — no
+ServiceRequest row is created, no interceptor runs, and **no existing report shows it**. The REQ
+simply does not exist on our side and nobody is told. The cron
+`worker/crons/notifications/reports/prudential/prudential_auth_rejection_alert.php` closes that
+gap: every 15 minutes it reads refused inbound REQs straight from the API logs and emails them
+with the full payload, so they can be resubmitted the same hour instead of being found weeks later.
+
+This is the **auth-layer** sibling of the 2.0 validation alert
+([service-request-rejection-alert-email.md](service-request-rejection-alert-email.md)), which
+covers 400s. The two never overlap: a 400 reaches the model, a 401 never does.
+
+## Why it exists (the 2026-08/09 incident)
+
+REQ4492868 was reported missing. It **did** reach us on 2026-08-31 09:45:18 (POST
+`/v2/service-requests`, BREAKFIX, RITM6763537) and came back **401 `EN-4` "The provided token has
+expired"**. ServiceNow (sourceIp `199.91.136.12`) collected a JWT at 07:40:47 that expired at
+08:40:47 (1-hour life) and then kept reusing that same dead token for hours — every refused row
+carries the **identical `exp`**. **36 REQs** were refused this way across 31 Aug and 1 Sep. 14 were
+later resent and created fine (the Reclaims, replayed 1 Sep ~15:00); **22, including REQ4492868,
+were never resent and are still missing.** The whole class of failure was silent for a week.
+
+## Why nothing else caught it
+
+- `worker/crons/notifications/reports/prudential_exception_report.php` (daily, 9:00 AM) only queries
+  response codes **201, 400 and 500**, and only against **`Logs_Prudential`** (`db_prod_logs_prudential`).
+- `prudential_api_500_retry.php` only queries **500**.
+
+So **401 and 403 were the two codes nobody was looking at** — and a 401 is not even in the schema
+those reports read. This is also why the new cron cannot double-report: no other job touches these
+codes.
+
+## Where a refused request is actually logged (the load-bearing fact)
+
+- **401 → the SHARED BASE `Logs` schema** (`db_prod_logs`), **not** `Logs_Prudential`. The
+  expired-token check runs in the auth chain in `api2/Component/Api/V2/V2.php` (~L2088, inside
+  `execute()`) **before** routing, so the client is not resolved yet and the row cannot be written
+  to the client log schema.
+- **403 → `Logs_Prudential`.** By then the client **is** known.
+
+Verified for 31 Aug – 1 Sep: `Logs_Prudential.Api` holds **56 rows** for `/v2/service-requests`,
+**all 201**; every one of the **36 401s** is in base `Logs`.
+
+**Consequence: a model `prePost` / interceptor can NEVER fire for a 401** — the request never
+reaches routing or the model. That is why this alert had to be a log scan and not a hook. The
+client is still identifiable: decode the expired Bearer token and read `id.client.uuid`.
+
+## How it works
+
+1. Floor the clock to the quarter hour and read exactly `[end - 15 min, end)`.
+2. Read **401s from base `Logs`** (`db_prod_logs`) and **403s from `Logs_Prudential`**
+   (`db_prod_logs_prudential`), both filtered to `direction = 'IN'`, `method = 'POST'`,
+   `route = '/v2/service-requests'`.
+3. Decode the Bearer token in `requestHeaders` to confirm the caller is Prudential
+   (`App_Api_Toga2::CLIENT_UUID_PRUDENTIAL`). A **missing** token yields no uuid — those rows are
+   **still reported**, deliberately, rather than dropped.
+4. Map the `EN-*` code from the response payload to a plain-English sentence
+   (`EN-1` no token sent · `EN-2` unreadable · `EN-3` not valid · `EN-4` expired · `EN-5` altered ·
+   `EN-6` address not allowed), and classify the row as **Login** (401) or **Permissions** (403).
+5. Email one grouped HTML table — REQ number, RITM number, type, time raised in ServiceNow, time it
+   reached us, reason — plus a **CSV attachment whose last column carries the full request
+   payload**, so the mail can be forwarded to Prudential as proof of what they sent.
+6. Send **nothing** on a quiet run. Cap of `MAX_ROWS_PER_RUN = 500` so one bad hour cannot produce a
+   giant email.
+
+Schedule entry in `worker/schedules/cron.worker.notification.json`: `"*/15 * * * *"` →
+`notifications/reports/prudential/prudential_auth_rejection_alert.php` (notification worker role).
+Recipients: `vburks`, `rgirish`, `ADiamond`, `kmaramreddy` @togatech.com.
+
+## Design decision — no state table, no state file (clock-aligned window instead)
+
+The first design kept a "last processed log id" marker. Both marker forms were rejected:
+
+- **A file marker is wrong here.** The worker cache folder is `/var/www/cache`, **local to each
+  Elastic Beanstalk instance** and recreated on every deploy (see
+  `worker/ebs/setup_export_cache_folders.php`). The same rejections would be emailed once *per
+  instance*, and the marker is lost on every deploy.
+- **A DB marker table** was drafted, then rejected as too much machinery for the value.
+
+**Final design:** each run floors the clock to the quarter hour and reads `[end - 15 min, end)`.
+Consecutive slices touch but never overlap, so no row can be read twice — **with no state at all.**
+
+**Known trade-off, accepted:** a skipped run (deploy, restart) loses that 15-minute slice. Do not
+"fix" this by re-adding a marker without re-reading the two reasons above.
+
+## Gotchas
+
+- **Filter `method = 'POST'` or you get browser noise.** Unauthenticated **GET**s on this route from
+  human sourceIps (`99.179.145.25`, `107.139.5.190`) also log 401, with an **empty `requestPayload`**
+  — they show up as REQ "Unknown". Only a POST is a real ServiceNow submission.
+- **`prudential_api_500_retry.php` is broken and has almost certainly never worked.** At lines 57
+  and 70 it references a bare constant **`PRUDENTIAL_CLIENT_UUID` that is defined nowhere** in any
+  repo (grep returns only its own two uses); it should be `App_Api_Toga2::CLIENT_UUID_PRUDENTIAL`.
+  On PHP 8 an undefined constant is a **fatal Error**, so the cron dies every run; on PHP 7 it
+  evaluates to the literal string and the client check never matches, so it silently retries
+  nothing. It also appears in **no** `schedules/*.json` file, so it may never have been registered.
+  **Not fixed as of 2026-09-10 — reported only.**
+- **`Logs.Api.dtStamp` IS indexed** (`Api_dtStamp_IDX`) in both base `Logs` and `Logs_Prudential`,
+  which is what makes the 15-minute window read cheap. But `route` and `responseCode` are **not**
+  indexed, so a wide `dtStamp` range plus a route filter still times out (a 2.5-month grouped query
+  aborted at 300 s). Keep the window tight. See
+  [request-logging.md](../../../2.0/apps/api2/features/request-logging.md).
+
+## Telling "we refused it" from "they never sent it"
+
+Two different failure shapes get reported the same way ("REQ is missing"):
+
+- **Refused by us** — there IS an inbound POST row on `/v2/service-requests` with a 401/403 and a
+  full `requestPayload`. That is REQ4492868. Prudential must resubmit.
+- **Never sent** — no inbound row at all. That is **REQ4398272**: absent from
+  `Client_Prudential.ServiceRequests` under both `c_reqNumber` and `c_ritmNumber`, and absent from
+  `Logs_Prudential.Api` (1 May – 15 Jul) and base `Logs.Api` (10–16 May) — no POST, no 401, no 400,
+  no 500. By the surrounding REQ numbers it would have been raised 2026-05-12 between 11:23 and
+  12:53 (REQ4398185 landed 11:23, REQ4398357 landed 12:53). Base `Logs` retention reaches back to
+  Aug 2025, so the window is genuinely covered. The problem is on the ServiceNow side.
+
+Always check **both** schemas before answering — a 401 will not be in `Logs_Prudential`.
+
+## Change history
+- 2026-09-10 — Created. New 15-minute cron
+  `notifications/reports/prudential/prudential_auth_rejection_alert.php` alerting on Prudential REQs
+  refused with **401 (base `Logs`) or 403 (`Logs_Prudential`)**, with an HTML table plus a
+  full-payload CSV for forwarding to Prudential. Found after REQ4492868 was reported missing: it was
+  refused 2026-08-31 09:45:18 with `EN-4` (expired token), one of **36** refused across 31 Aug–1 Sep
+  from a JWT ServiceNow collected at 07:40:47 and reused past its 08:40:47 expiry — **22 still
+  missing**. Recorded why nothing caught it (the daily exception report reads only 201/400/500 and
+  only `Logs_Prudential`), why a `prePost` hook cannot work for a 401, the **no-state clock-aligned
+  window** decision (the `/var/www/cache` marker is per-instance and dies on deploy), the
+  **POST-only** filter that excludes browser 401 noise, that `dtStamp` is indexed while
+  `route`/`responseCode` are not, and that `prudential_api_500_retry.php` is dead on an undefined
+  `PRUDENTIAL_CLIENT_UUID` constant. (bala)

package/knowledge/clients/prudential/features/service-request-rejection-alert-email.md

@@ -6,13 +6,14 @@ project: Worker
 client: prudential
 type: client-feature
 status: active
-updated: 2026-07-28
+updated: 2026-09-10
 owners: ["bala"]
 files:
   - worker2/Worker/Client/Prudential/reports/ReqRejectionEmail.php
   - _underscore/Model/Prudential/ServiceRequest.php
 related:
   - service-request-address-validation.md
+  - service-request-auth-rejection-alert.md
   - ../../../2.0/apps/_underscore/features/email-send-pipeline.md
   - ../profile.md
 ---
@@ -79,11 +80,21 @@ known residual risk.
   validation block completes (e.g. the unguarded `serviceRequestUnits[0]->unit` access — see
   `service-request-address-validation.md`) produces a **500 and no alert**. Fix that guard to
   keep the alert reliable.
+- **This alert only covers 400s — a 401/403 never reaches `prePost` at all.** An expired or bad
+  ServiceNow token is refused in the auth chain *before* routing, so the model never runs and no
+  interceptor can fire; the row is also logged to the **base `Logs`** schema, not `Logs_Prudential`.
+  Those refusals are alerted separately by the 1.0 worker cron in
+  [service-request-auth-rejection-alert.md](service-request-auth-rejection-alert.md). Do not extend
+  this interceptor to try to catch them.
 - **"Plain text" is transmitted HTML anyway.** `setIsHtml(false)` is honored by `_Email` when it
   queues the row, but the worker2 `Infrastructure/Email/Send` action calls `IsHTML(true)`
   unconditionally, so the message is sent HTML-mode regardless (see `email-send-pipeline.md`).
 
 ## Change history
+- 2026-09-10 — Scoped: this alert fires only for **validation 400s**. A **401/403** is decided in
+  the auth chain before routing, so `prePost` never runs and this email never sends for it — those
+  refused REQs are covered by the separate 15-minute worker cron
+  `prudential_auth_rejection_alert.php`. No code change. (bala)
 - 2026-07-28 — Created: real-time internal alert on `POST /v2/service-requests` validation
   rejection. `prePost()` now collects all validation errors and enqueues the
   `ReqRejectionEmail/sendRejectionEmail` worker task (REQ# + reason + full payload) before

package/knowledge/clients/prudential/profile.md

@@ -15,7 +15,7 @@ project: _Underscore
 client: prudential
 type: profile
 status: active
-updated: 2026-08-28
+updated: 2026-09-10
 owners: ["jcardinal", "rgirish", "bala", "mhammontree"]
 files: []
 related:
@@ -23,10 +23,13 @@ related:
   - features/dell-asn-units-interceptor.md
   - features/service-request-address-validation.md
   - features/service-request-rejection-alert-email.md
+  - features/service-request-auth-rejection-alert.md
   - features/dell-lch-iop-transmissions.md
   - features/device-information-import-and-contact-linking.md
   - workflows/http2-alb-workaround.md
-  - features/supply-orders-csv-export.md
+  - features/service-request-auth-rejection-alert.md — the 15-minute refused-REQ (401/403) alert cron,
+  where each code is logged, and how to tell "we refused it" from "they never sent it".
+- features/supply-orders-csv-export.md
   - features/order-email-pdf-attachments.md
 ---
 
@@ -89,6 +92,13 @@ The order-created cron branches on this id; the shipped/delivered crons branch o
   (E_ALL→ErrorException), so `!== false` guards do not work — use the `safeFetchPdf()` pattern. See
   the exception report and the transmit-ordershipped-email feature doc.
 
+- **Inbound REQs we refuse (401/403) are invisible in `Logs_Prudential`.** A 401 is logged to the
+  **shared base `Logs`** schema because the client is not resolved yet; only a 403 lands in
+  `Logs_Prudential`. The daily `prudential_exception_report.php` reads only 201/400/500 in the
+  client schema, so refused REQs went unseen for a week in Aug 2026 (36 refused, 22 never resent).
+  The 15-minute `prudential_auth_rejection_alert.php` cron now alerts on them — see
+  features/service-request-auth-rejection-alert.md.
+
 ## Monitoring
 - `Monitor/Prudential/{SalesOrderGenerationBacklog,DellPurchaseOrderTransmissionBacklog,OrderShippedUpdateBacklog}`
   (worker2 → OneUptime) watch the order pipeline for stalls. Thresholds are DB-tunable and the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.794",
+  "version": "1.0.796",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",